Enable 1 Pod Execution Role Per Cluster

[Nuru]

what

• Enable 1 Pod Execution Role Per Cluster by allowing users to create either a role or a profile or both
• Deprecate "profile role" terminology in favor of "pod execution role"
• Update example
• Update tests
• Update README and workflows

why

• All Fargate Profiles can use the same Pod Execution Role, and there is no advantage (and several disadvantages) to using a different role with each profile. This module used to always create both a profile and a role. Now it allows you to create one or the other or both.
• The term "profile role" is confusing and suggests using one role per profile. The term "pod execution role" matches AWS documentation.
• Example used old modules that were incompatible with AWS provider v5 and did not set ALB tags.
  • Supersedes and closes Added missing ALB required tags #27.
  • Supersedes and closes Support AWS Provider V5 #31.
• Explain 1 role per cluster. Supersedes and closes Update README.md and docs #32

[Nuru]

/terratest

[aknysh]

LGTM, a few nitpicks

[dudymas]

I think this would be less painful like this

Suggested change

	fargate_profile_iam_role_name = local.fargate_pod_execution_role_name != null ? local.fargate_pod_execution_role_name : (
	var.fargate_profile_enabled ? "${module.role_label.id}${var.iam_role_kubernetes_namespace_delimiter}${var.kubernetes_namespace}" :
	module.role_label.id)
	fargate_profile_concatenated = "${module.role_label.id}${var.iam_role_kubernetes_namespace_delimiter}${var.kubernetes_namespace}"
	default_fargate_profile_role_name = var.fargate_profile_enabled ? local.fargate_profile_concatenated : module.role_label.id
	fargate_profile_iam_role_name = coalesce(local.fargate_pod_execution_role_name, local.default_fargate_profile_role_name)

[Nuru]

Problem is:

fargate_profile_concatenated = "${module.role_label.id}${var.iam_role_kubernetes_namespace_delimiter}${var.kubernetes_namespace}"

fails with Error if var.kubernetes_namespace is null, which it could be if user is only provisioning the Pod Execution Role.

[dudymas]

okay, I wouldn't see why that couldn't be coalesced as well.
So:

fargate_profile_concatenated = "${module.role_label.id}${var.iam_role_kubernetes_namespace_delimiter}${coalesce(var.kubernetes_namespace,"")}"

or if any number of the elements could be null, then use:

fargate_profile_concatenated = join("", compact([module.role_label.id,var.iam_role_kubernetes_namespace_delimiter,var.kubernetes_namespace]))

[dudymas]

To be clear, I'm just offering options to avoid a nested conditional.

[Nuru]

coalesce fails when all the arguments are empty. The advantage of the ternary operator in Terraform is that the unused expressions are not evaluated and need not be valid.

[dudymas]

This is functionally fine, but added some readability and comprehension remarks

[Nuru]

/terratest

[Nuru]

/terratest